fix(plugin-npm): bypass npmMinimalAgeGate when publishTimes metadata …

[Ayush442842q]

What's the problem this PR addresses?

When npmMinimalAgeGate is enabled (defaulting to 1d), Yarn attempts to enforce a minimum package age using the release dates returned by the package registry. However, some registries (such as GitHub Packages) do not return the time field in their package metadata responses.

Under the current implementation, if the time metadata object (publishTimes) is missing from the registry response, shouldBeQuarantined treats the version time as undefined and quarantines all package versions by default. This makes registries like GitHub Packages completely unusable out of the box without manually disabling the age gate configuration.

Closes #7231

How did you fix it?

We updated the shouldBeQuarantined check in packages/plugin-npm/sources/npmConfigUtils.ts to only perform the age gate verification if publishTimes metadata is actually provided by the registry:

function shouldBeQuarantined({configuration, ident, version, publishTimes}: IsPackageApprovedOptions) {
  const minimalAgeGate = getMinimalAgeGate(ident, {configuration});

  if (minimalAgeGate && publishTimes) {
    const versionTime = publishTimes[version];
    if (typeof versionTime === `undefined`)
      return true;

    const ageMinutes = (new Date().getTime() - new Date(versionTime).getTime()) / 60 / 1000;
    if (ageMinutes < minimalAgeGate) {
      return true;
    }
  }

  return false;
}

If publishTimes is missing entirely (meaning the registry does not publish package version release dates), the age gate check is bypassed and the versions are not quarantined.

Changes Included:

• Core logic: Bypassed age gate in packages/plugin-npm/sources/npmConfigUtils.ts when publishTimes is undefined.
• Mock registry: Modified the acceptance tests package server in packages/acceptance-tests/pkg-tests-core/sources/utils/tests.ts to omit release time metadata for packages starting with no-time- to simulate registries like GitHub Packages.
• Fixtures: Added the no-time-deps package fixture.
• Integration test: Added a test case in packages/acceptance-tests/pkg-tests-specs/sources/features/npmMinimalAgeGate.test.ts to verify that packages with no time metadata can be successfully resolved and installed.

Checklist

• I have read the Contributing Guide.
• I will check that all automated PR checks pass before the PR gets reviewed.
• I have set the packages that need to be released for my changes to be effective.